The Secret Internet

The Secret Internet

You may have never heard of Choicestream, Criteo or m6d, but if you've ever looked at a pair of shoes on Zappos.com, odds are they know something about you. They are just three of 13 firms that are notified by the online retailer when you land on its home page. Similarly, a visit to CNN.com is tracked by eight sites operated by third-party companies, while Dictionary.com informs 12 others about your presence on its site. In almost all cases, the companies are in the business of tracking, measuring and analyzing consumer behaviour on the web, mostly through the use of cookies (tiny pieces of code that websites install on your computer), allowing advertisers to target you with personalized ads for products and services.

It's called "behavioural tracking," and it has ballooned in recent years. A recent study by the Berkeley Center for Law and Technology at the University of California found the web's top 100 sites left a total of 5,795 cookies on its test computer this year, compared with 3,602 three years ago, a 60 per cent increase. Another study by data-management company Krux Digital found that a visit to an average web page triggered an average of 56 instances of data collection in 2012, up from 10 instances in 2010. "I look at this picture and it freaks me out," Gary Kovacs, the CEO of Mozilla, recently told a packed auditorium as he unveiled a new plug-in for the company's popular Firefox browser that allows users to "track the trackers" and see the results in a nifty graphical interface. "I'm being stalked across the web."

Indeed. Where advertisers once simply threw up banner ads on high-traffic websites and hoped for the best, behavioural tracking now allows them to beam individually tailored ads, in real time, to users just as they land on a web page. The decision to show you an ad can be based on your geographic location, what else you've looked at online or, in some cases, educated guesses about your age, income and marital status. And thanks to ever more invasive technologies (more on this later), there's no guarantee that simply toggling off cookies in your browser settings will stop the snooping.

While the industry, which generates some US$31 billion annually, describes behavioural tracking as a "win-win"--advertisers enjoy more click-throughs while web surfers see more ads for things they might actually be interested in--privacy advocates warn it's all taking place behind the scenes without people's knowledge and little regulatory oversight, raising the potential for abuse. They also scoff at industry claims that users' anonymity is being protected because cookies track computers, not people. We live in an age where the web is increasingly accessed from personal devices like iPhones and iPads, and is used for everything from personal banking to diagnosing potential health issues. Mobile devices also make it possible for companies to pinpoint your location--from a jewellery store downtown to sitting on your couch watching a movie. And as the web spreads to other media, including television and gaming devices, there are fears these secret online profiles could follow you everywhere. "This is well beyond simply sending you a targeted ad for a pair of shoes and a T-shirt you might be more interested in," warns Jeffrey Chester, the executive director of the Center for Digital Democracy, a non-profit consumer protection and privacy group based in Washington. "It frequently involves matters of a highly personal and sensitive nature: your finances, your health, your kids and your race."

Nor is it just ads that users need to worry about. The same technology also makes it possible for companies to target consumers with "personalized" content, products and even prices on the websites they visit. The travel website Orbitz.com recently admitted to showing Mac users pricier hotel options than their PC counterparts after its research showed that buyers of expensive Apple gear also tend to spend more on hotels. The rare admission sparked a public outcry and suggested a new form of digital discrimination. Some banks, meanwhile, are using behavioural data to decide which credit cards to show customers, and there are concerns that everyone from online retailers to airlines are tinkering with prices depending on who's looking and what their digital profile says about them.

Such tactics are not illegal, but they strike many as inherently unfair, not to mention a bit creepy. And it all adds up to a massive shift in the balance of power on the web--one that increasingly favours big corporations at the expense of consumers and their privacy. "We're seeing the push back," says Siva Vaidhyanathan, a professor in the department of media studies at the University of Virginia and the author of the The Googlization of Everything. "If you remember back in the late 1990s, people were talking about the great potential of the INTERNET to not only democratize communication, but to make us better and more informed consumers. But in the Orbitz case, you now see that, as a Mac user, I'm at a disadvantage. They've rigged the game so that Mac users like myself are more likely to pay more money. We're not operating on a level playing field any more."

The boom in behavioural tracking has centred around some familiar names like Google, Quantcast and ComScore. But they are only the tip of the iceberg. After just 48 hours of regular web use, a single Maclean's computer recorded more than 100 different third-party-owened websites that had potentially received data on its activity, representing roughly four times the number of sites that were actually visited. Many of the firms--Zedo, DataXu, Omniture for example--are likely ones that most users have never before encountered, at least not on purpose. (Maclean's own website sends information to nine other sites, according to Mozilla's plug-in tool). There are some unexpected surprises, too. Twitter tracks people on a wide variety of websites even if they've never signed up for its service. It uses the data, compiled on websites that have integrated Twitter buttons, to help it suggest people for its new members to follow.

Experts say the sudden rise in online tracking is being fuelled by the growth of real-time bidding exchanges. These are systems that allow advertisers to buy ad space on a website the moment somebody of interest lands on it. The decisions, made by computers in a fraction of a second, are usually based on pre-set parameters such as the users' location, what site they navigated from or any profile that's been created as a result of their browsing history. It's not unlike the hugely profitable system Google devised to allow advertisers to bid on keywords entered into its popular search engine.

One common example of how tracking and bidding exchanges can be used to dramatically boost sales is re-targeting, or the Internet equivalent of a callback. A user arrives on a website, looks around, but doesn't buy anything. Before the user leaves, a cookie is dropped on the computer that records the product looked at. Later on, the user can be targeted with an ad for the same product somewhere else on the web. Does behavioural tracking work? "It's night and day," says Steven Goldhar, the president of Toronto's Sundance Media, which helps companies optimize their online sales and marketing. "In the old days, you had to just wait and see how many people would click on something and buy it, but now you can see everything."

Increasingly, a number of companies are using the same approach to steer people toward products and services they're more likely to buy. Orbitz upset Mac users by sorting visitors based on which operating system they used. Others are trying more sophisticated approaches by combining different data sets from multiple sources. A 2010 investigation by the Wall Street Journal focused on Capital One Financial, which was using the services of a company called [x+1] Inc. to decide which credit cards to show users that landed on its web page. The system combined location and browsing information with survey data from consumer research firm Nielsen, allowing visitors to be slotted into one of 66 demographic groups. One group was called "White Picket Fences" and included college-educated people who live in small cities, have a median household income of US$53,901, are 25 to 44 years old, with kids and work in white-collar or service jobs and generally own their own home. The newspaper tested the system with eight different people and found the profiles to be relatively accurate, causing it to conclude that companies like [x+1] are "transforming the Internet into a place where people are becoming anonymous in name only."

On the surface, the trend toward a more personalized web doesn't seem threatening. After all, one of the keys to Amazon's success is the sophisticated recommendation engine that suggests products you may be interested in. Apple uses similar tools to suggest songs on iTunes, while Facebook does it with friends. But things quickly get murky. Several observers say a majority of the industry's biggest online retailers are using behavioural data to determine people's price sensitivity--based on things like where a user shops online or whether their ISP address is associated with a high-income neighbourhood--and then altering their prices accordingly. "Increasingly the offers you get are tailored to what they think you can afford," says Chester. "So you may get a credit card with a higher interest rate offer than your neighbour, but you're never told that."

It's been tried before, albeit with limited success. Back in 2000, Amazon CEO Jeff Bezos apologized for a "random price test" in which DVDs were sold at different prices to different customers, and offered refunds to angry consumers. Dell, too, has used dynamic and differential pricing strategies based on whether buyers were business or personal users.

Of course, price discrimination also happens in the real world. Car salesmen size up customers who walk onto the lot based on what they're wearing. Restaurants hand out coupons in low-income neighbourhoods to drive business. But the difference online, critics argue, is that consumers have no way of knowing it's happening, and therefore can't take steps to protect themselves. "Price discrimination works to the advantage of the seller in every case," says Vaidhyanathan. "There's no way you can argue that price profiling works to the benefit of the consumer."

It raises the prospect of an industry coming full circle. Where once consumers flocked to the web to take advantage of comparison shopping sites, they may now be increasingly inclined to pick up the phone and call a travel agent, who, although they're perhaps not inclined to sell the cheapest airline seats, will at least not be privy to your preference for expensive meals and bespoke clothing.

Behavioural tracking's potential problems are already on the radar of regulators. Last December, Canada's privacy commissioner launched new guidelines for the industry that seek to prevent the use of technologies making it dif?cult to opt out of behavioural tracking, or the tracking of children. They include zombie cookies (cookies that reinstall themselves after they are deleted from your web browser), super-cookies (a cookie-like piece of code stored elsewhere on your computer) and device fingerprinting (a way to store identifying information about a computer or device even when cookies are turned off). "Many Canadians don't know how they're being tracked," said commissioner Jennifer Stoddart in a statement. "And that's no surprise because, in too many cases, they have to dig down to the bottom of a long and legalistic privacy policy to find out."

In the U.S., meanwhile, there are calls for the government to set up an official "do not track" mechanism, but so far there is relatively little agreement on how it would work. From the industry's perspective, "do not track" means the user couldn't be targeted with behavioural ads, but other kinds of tracking would be permissible to help personalize content and ensure the web functions smoothly. (Until recently, the data tracked by cookies was mostly used by webmasters to make sure their sites were working properly.) Privacy advocates, on the other hand, say all tracking should be shut off.

Many in the industry say the concerns are overblown. They argue behavioural tracking has so far served mostly to provide web users with a better overall experience. "You're just experiencing it as a little more attention, or a little better quality," says Omer Trajman, the vice-president of technology solutions for Cloudera, a Silicon Valley company that helps firms process vast quantities of information on a massive database system called Hadoop. (Trajman says that more than half of Fortune 500 companies in the Internet, retail, financial and media space are Cloudera customers.) "Really, it's the kind of personal attention that hasn't existed since there was literally personal attention--when there was only a few people in town and they knew the local shop keep."

However, Trajman admits that finding the right balance isn't easy. "If you walked into a Starbucks you've never been to before, and they have your drink ready? That's a little creepy," he says. "But if Starbucks had an iPad ordering menu that gives you three or four of your favourite options, that seems kind of delightful." A study co-written last year by Avi Goldfarb, a marketing professor at the University of Toronto's Rotman School of Management, came to a similar conclusion. It found that web users recoiled at big, obtrusive banner ads that contained elements of personalization, whereas smaller personalized ads didn't elicit the same negative response. Another turnoff, according to Goldfarb, is when people see personalized information in a place they don't expect it--a far-flung website, or in the hands of an unrelated company.

Such studies suggest that web users are fundamentally conflicted about where all of this is headed. They appreciate personalized services, and don't mind some personalized advertising, but don't want to inadvertently sell themselves down the river in the process. Nor are they keen on having faceless companies monitoring their every online move. (Shopping habits are generally considered to be private decisions, after all, and sharing them with strangers strikes a lot of people as unseemly.) Goldfarb calls it the conundrum of the Information Age: "As a society, we face a trade-off between innovation that comes from crunching large databases, which has been very vibrant over the last 15 years, and the level of privacy we want to achieve," he says. "If we want more privacy, we will have to accept that those services will be less useful." This is effectively the same argument that Google uses to defend its vast data capturing capabilities. "Fundamentally, we believe a personal web is a better web for people," says Eric Morris, the head of mobile advertising for Google Canada. "It allows people to find the articles, videos and businesses that they're interested in finding. And Google is able to provide a little bit more of that personalized information when we know a little bit more about the user."

But at what cost? "The era of big data raises new risks about security and data theft," warns Jeffrey Chester of the Center for Digital Democracy, adding that governments, law enforcement and others may also have an interest in people's online activities and profiles. While most companies have lengthy privacy polices that, for legal reasons, spell out what kind of information they collect, what it can be used for and who they may share it with, the policies can vary wildly from company to company, according to the Canadian Internet Policy and Public Interest Clinic. Tracking also poses a more fundamental threat to the Internet as we know it, dismantling--cookie by cookie--its original democratic and egalitarian ideals. "It's not just about protecting your data, it's also about social discrimination," says Joseph Turow, a professor at the University of Pennsylvania's Annenberg School for Communication. "Some people are more worthwhile to advertisers than others. Now, that's always been the case, but now what we have is a huge data operation that takes place every day, and it's trying to decide whether you're a target or a waste [of time.]" If you're unlucky enough to find yourself typecast as a deadbeat by advertisers, you can look forward to surfing a web chock full of debt consolidation ads and other unpleasant content--with no obvious way to rectify the situation. "More and more, these data collectors are becoming persistent, so you're not going to be able to get rid of them by simply emptying your cookies," Turow says. "As a consequence, people are going to have reputations that follow them across a variety of media."

One thing is certain: for individual users, the web is rapidly becoming a much smaller place. Personalized content. Individually tailored ads, products and services. That's not necessarily a bad thing considering that the total number of web pages indexed by search engines now totals nearly seven billion--far too many for any single person to explore. But users clearly need more transparency and control over the process.

Until then, Vaidhyanathan argues that people can protect themselves by recognizing that, despite their cute names and colourful logos, firms like Google, Facebook, Yahoo!, as well as the hundreds of others that toil away in their shadows, are profit-making corporations just like any other. "Once you've put Google in its place in your mind, then you can use it as a tool--a really powerful and effective tool," he says. "But if you imagine Google as a window to the world and the place to go for all answers, then you're likely to be at its mercy, rather than the other way around."

Maclean's August 13, 2012